EP0935214B1 - Smart card with integrated circuit - Google Patents

Description

The invention relates to a chip card with an integrated circuit containing a control unit in the form of a microprocessor and memory. Such smart cards are well known and used for various purposes. In many cases, such check cards are used for purposes that contain safety-related information on the card. This is the case, for example, with bank cards in which credit or credit lines are located on the check card, as well as personal secret numbers, or in the case of patient cards on which confidential information about the patient is to be read out, for example, only after entering a personal secret number. Furthermore, such cards are used as access control for certain rooms or buildings. In all cases, it should be prevented that secret data can be read out of the card by means of fraudulent manipulation or that data on the card can be changed in an undesired way.

EP-A-0 512 542 disclosed

, a chip card with microprocessor and memory, in which an illegal, i. unwanted access to data in the card for reading or changing with the greatest possible security is prevented. In this case, a decoupled from the actual microprocessor circuit protection circuit is provided which monitors each addressed addresses.

The object of the invention is to provide a chip card with microprocessor and memory, can be dispensed with on the additional protection circuit, but still an inadmissible access to data is prevented.

This object is achieved by the characterizing part of claim 1. Thereby is the access to all such registers and memory, in which safety-related information is located, only possible in system mode. The system mode works with a permanently stored program, which of course can not be read or changed from outside. This program is independent of the respective applications.

This has the advantage that such a system program must be checked and released only once on its safety-related functions. The user programs, which are created and put on the map by the appropriate institutions, such as banks or health insurances, then need not be specially examined. Any access to secret data in the context of a user program is carried out exclusively via the system program. This is especially important for smart cards that serve more than one application. The system program ensures that all the different user programs are unambiguously and reliably separated from each other and that one user program can not access another or the data used therein.

To access secret data that is to be legitimately used in a user program, a certain jump is always triggered into the system program, which switches the mode bit. In system mode, all registers and all memory locations are accessible. On the other hand, it can be checked in the system mode, whether the desired access is actually allowed. This check can not be disabled by a fraudulent user. An access to secret data is also equal to every input and output operation of data.

The blocking of memory locations or the release of certain memory areas for each user program is achieved in a simple manner that the memory is divided into certain areas, which also with Segments or pages are called, and different user programs are then expediently assigned to different segments. The segments are determined by the content of one or more corresponding registers, which can only be changed in system mode. As a result, memory areas of various user programs are safely separated from each other.

In addition, within a segment, access to only a portion of this segment may be enabled by providing additional registers for an indication of a boundary address within a segment. Each address, i.e. the lower order bits are automatically compared to the contents of such a register. These registers can only be read and overwritten in system mode.

Furthermore, a bit group is provided, preferably in the segment register, the value of which is written into the memory location together with the written-in data. During read-out, it is then checked whether the content of the corresponding area of the memory location matches this bit group. If this is not the case, reading is disabled.

If a user program in user mode is to access a register or a memory location that is not permitted in this user program, instead of a special system message, only a value corresponding to an empty memory cell can be output, ie not after the card has been produced has been described. In this way, a fraudulent user can not tell if he really wanted to access an empty space or a locked space. In addition, such a value corresponds to an unconditional jump in the system mode.

The blocking of all unauthorized memory areas thus takes place via registers that can only be changed in system mode. These registers form at least part of the registers for special functions, the so-called SF registers. These registers are interconnected via an in-register bus. In addition, this internal register bus has an interface to the internal data bus, via which data can be written from the data bus to the registers or read from the registers to the data bus. Appropriately, this register bus is now divided by a switch that is closed only in system mode. This is a very easy way to lock the corresponding registers and indirectly also all inaccessible memory locations.

• Fig. 1 ein Blockschaltbild der wichtigsten Teile eines Mikroprozessors für eine Chipkarte,
• Fig. 2 den genaueren Aufbau eines Details daraus,
• Fig. 3 ein Blockschaltbild für die Überprüfung von Adreßgrenzen,
• Fig. 4 ein Blockschaltbild für die Prüfung des Inhalts von Speicherplätzen,
• Fig. 5 eine symbolische Darstellung der Unterteilung zwischen geschütztem SystemBereich und ungeschütztem Benutzer-Bereich,
• Fig. 6 ein Beispiel für den Aufbau eines Programmstatusworts in zwei getrennten Registern.

Embodiments of the invention are explained below with reference to the drawing. Show it:

• Fig. 1 a block diagram of the most important parts of a microprocessor for a smart card,
• Fig. 2 the more detailed construction of a detail from it,
• Fig. 3 a block diagram for checking address boundaries,
• Fig. 4 a block diagram for checking the contents of memory locations,
• Fig. 5 a symbolic representation of the division between the protected system area and the unprotected user area,
• Fig. 6 an example of building a program status word in two separate registers.

The Fig. 1 schematically shows the essential parts of the invention for a microprocessor. To an internal bus 11, which includes a number of data and control lines, a program counter 10 is connected, which can be set via the data bus to a specific address and otherwise autonomously continues counting. The necessary control signals are with the program counter as well in the other elements in this figure and in the other figures for clarity, not shown individually.

The program counter 10 delivers its contents to a memory management unit MMU 14, which supplies a memory 20 with address and control signals via a connection 15. This memory 20 expediently consists of several memory units, namely in particular a ROM for the system program or essential parts thereof, a writable EEPROM for user programs and certain fixed data such as secret numbers and a volatile RAM, in particular for storing intermediate results in individual processing steps. The selection of the individual memory is done by control signals via the connection 15. Via a connection 29 data read out from addressed memory locations is output or fed into writable memory locations data to be written.

The MMU 14 is also directly connected to the bus 11 to supply data from the bus 11 to the memory 20 as addresses. In addition, the MMU 14 is connected to registers 18, which are shown here in simplified form as a block and which contain information about which memory unit is to be selected in the memory 20 and, in addition, which memory area or address area in the selected memory unit is addressed. For this purpose, in particular the EEPROM memory unit is divided into areas, which are generally referred to as segments or pages. Each user program is assigned one or more specific segments for program information and data that are defined when the relevant user program is written. These assignments can only be changed by the system program, as will be explained later.

An arithmetic logic unit ALU12 is connected to an input to the bus 11. The internal structure of this unit, which includes in particular a computing unit and an accumulator and other registers, is known per se and therefore not shown here. The results of this unit 12 are returned to the bus 11 again. In addition, some signals that occur when performing calculations, such as carry signals, overflow messages, or null values, are fed via a link 13 to a register 26 which contains part of the so-called program status word. The second part of the program status word is contained in a register 28.

For the input or output of data, for example from outside the smart card or from a coprocessor in the chip card or on the same chip as the microprocessor, registers 24 are provided, which can be loaded via a connection 25 from outside the microprocessor or to outside data can give.

The registers 18, 28 and 24 are interconnected via a special bus 23 which leads to a connection unit 30. To this bus 23 further registers may be connected, as indicated by the dashed line to the connection unit 30. The connection unit 30 is further connected to an internal bus 21, which leads to the register 26 for the one part of the program status word and to a coupling unit 22, which connects this bus 21 to the bus 11 with appropriate control via control lines not separately shown. The buses 21 and 23 represent the usual in microprocessors internal bus for the registers for special functions. These two parts form a single bus, when the connection unit 30 connects by driving via the line 27, the two bus parts.

The control line 27 is connected to a certain part of the register 28 which contains a mode bit. The value of this bit determines if the microprocessor is operating in system or user mode. When the value of this bit indicates the system mode, the connection unit 30 is driven to connect both bus parts 21 and 23 with each other, so that then a uniform bus is prepared, over which all registers for special functions, such as the illustrated registers 18, 24, 26 and 28 and optionally further, not shown registers are interconnected. In system mode, all registers can be accessed. In user mode, the connection unit 30 is actuated by the corresponding other value of the mode bit via the control line 27 in order to separate the two bus parts 21 and 23. Now, the registers 18, 28 and 24 as well as other registers connected to the bus 23 can no longer be accessed, neither for writing nor for reading only.

The transition from user mode to system mode is done by a special jump instruction which switches the mode bit in register 28 to system mode. At the same time the beginning of the system program is called, the essential content of which is fixed unchangeable. In the system program, for example, the register 18 can be changed in order to be able to address other memory units or other segments in a memory unit in the subsequent user program. At the end of the system program, the mode bit is switched back in register 28, and thus the connection to the bus 23 is interrupted again via the control line 27 in the connection unit 30, so that then no access to the registers connected thereto is possible.

In Fig. 2 the structure of the connection unit 30 is shown in somewhat more detail. The transfer of data from the bus 21 to the bus 23 via a switch 302, while the data to be transmitted from the bus 23 to the bus 21 via a switch 304. The switches 302 and 304 are driven together via the control line 27. In the in Fig. 2 In the illustrated position of the switches 302 and 304, the connection is broken and data is transmitted to the bus 21 coming from a fixed data line 306. For example, this data value corresponds to the value of the jump instruction that jumps into system mode. So if in a user program prohibited Thus, if a non-permitted register is to be accessed, a value corresponding to the branch instruction is read out. If this value is to be interpreted as a command, such a forbidden access always takes place in the system mode, in which only specified command sequences that can not be changed by a user are executed.

In Fig. 3 Some parts of the MMU14 are shown in more detail. The connection to the bus 11 leads to an address calculator 140, where the data from the bus 11 as an address with a via the connection 19 from the register 18 in Fig. 1 coming address part of higher significance and output via the connection 141. The connection 141 leads to a blocking unit 144 and a comparator 142. A second input of the comparator 142 is connected to the output of a register 32, which is also connected as a register for special functions to the bus 23, which is accessible only in system mode and can be loaded in this system mode with a value for an address boundary. This address boundary is compared with preferably parts of the address on the connection 141, and if the address is within the predetermined limit, the blocking unit 144 is enabled by the comparator 142 via the line 141 and the address via the connection 15 to the memory 20 in Fig. 1 fed. In this way, in the user mode, access to a part of a segment associated with the relevant user program can be blocked.

Another safeguard against access to unauthorized data is in Fig. 4 shown schematically. If out of the memory 20 in Fig. 1 the contents of a memory location are read out and the corresponding data are output via the connection 29, these are supplied to a comparator 42 and a further blocking unit 40. The comparator 42 receives at a further input data from the register 18, which has been loaded via the bus 23. The comparator 42 checks certain parts of the data word on the connection 29 for equality with the data supplied by the register 18. Only if equality is over the line 43 the blocking unit 40 is enabled and the data is delivered on the connection 45. These data are written in response to corresponding control signals on control lines not separately shown in a data register 44 which supplies these data to the bus 11, or in command register 46, which supplies this data as a command to a command decoder, not shown.

If from the bus 11 via the data register 44 data in the memory 20 in Fig. 1 are to be written, they also go through the blocking unit 40 and there are supplemented by data according to the contents of the register 18 and written via the connection 29 in the memory 20. As a result, the required equality with the content of the register 18 is determined when reading this data in the associated user program. In another user program in which these test data have a different value, therefore, data from a foreign user program can not be accessed.

In Fig. 5 symbolically the division into a protected system part 50 and an unprotected user part 60 is shown. In the user part 60 access to a stack memory 62 and the program counter 64 is released. In addition, one half of the program status word register 59 is available to this user part. The other part of this register 59 is only available to the system part 50. Therein, system stack 570, 571 can be accessed via register 57, as well as via an interface 52 to the special function register bus 52, such as write enable memory register 56 and general access register 55 Memory and the register 54 for input / output operations and a register 53 for a coprocessor, which is preferably arranged on the same chip. There may be other such registers, not shown.

The system area 50 with the access possibilities to the units indicated therein is only possible if the mode bit is set. In the user area, access to the units 62 and 64 shown therein is possible, but not to the units shown in the system area 50.

In Fig. 6 an example of the structure of a program status word 70 is shown. Section 71 contains the mode bit. Section 72 contains a bit that can be used to check the program sequence, which is especially important when creating programs. The content of section 73 is for register selection. The contents of section 74 mask interrupt requests. These sections belong to that half of the program status word that can only be changed in system mode.

The part after the double stroke is also readable and changeable in user mode and contains two sections 75 and 76, in which carry signals stored in the ALU12 in FIG Fig. 1 arise. The section 77 can be largely defined freely by the user program. In section 78, the message is stored that in the ALU12 in Fig. 1 an overflow has occurred. Section 79 indicates that a negative result has occurred in the ALU 12, and section 80 indicates that the value zero has arisen in the calculation. Since this only signals the ALU12 in Fig. 1 are, the access to these areas must also be possible in user mode.

Claims (7)

1. A chip card with an integrated circuit provided with a control unit in the form of a microprocessor and at least one memory with a plurality of memory locations that can be accessed via addresses, characterized in that the microprocessor includes a plurality of registers of which at least a PSW register contains a program status word in which the value of at least one predetermined mode bit determines a user mode or a system mode, the access to at least parts of the PSW register as well as to all registers and memory segments that are used only in the system mode being inhibited when the mode bit indicates the user mode.
2. A chip card as claimed in claim 1, in which the PSW register comprises at least a first sub-register and a second sub-register and the first sub-register contains the mode bit as well as information for the selection of one from a plurality of register blocks and can be read and modified only in the system mode.
3. A chip card as claimed in claim 1 or 2, in which each interrupt request occurring in the user mode triggers a jump to the system mode which switches over the mode bit, and all registers which serve for input/output operations and for the control of control circuits coupled to the microprocessor are used only in the system mode.
4. A chip card as claimed in any one of the preceding claims, in which at least one of the registers is a first segment address register which contains the address of a memory segment containing data for the current program that is being executed, and at least a further register is a second segment address register which contains the address of a preferably other memory segment and a modification of the first and the second segment address register is inhibited in the user mode.
5. A chip card as claimed in any one of the preceding claims, in which further registers are address registers of which each one indicates a respective address within a memory zone indicated by the segment address register, each address register having assigned to it an associated auxiliary address register which can be modified only in the system mode and contains at least the most significant bits of the address as well as test information and there being provided a comparator which compares the test information of the auxiliary address register with information read from predetermined bit locations of the addressed memory location and, in the user mode, enables the further transport of the information read from the addressed memory location, or a modification of the information of the addressed memory location, only in the case of correspondence between the test information and the information read out.
6. A chip card as claimed in any one of the preceding claims, in which from a register which is addressed in the user mode and is used only in the system mode only a predetermined bit pattern, preferably being the bit pattern of a memory location that has not been modified after the manufacture of the integrated circuit is transported.
7. A chip card as claimed in any one of the preceding claims, in which the registers are connected, over a bus, to the remainder of the circuit of the microprocessor in such a manner that the registers which are used only in the system mode are arranged at the end of the bus that is remote from the microprocessor and an inhibit gate which is controlled only by the mode bit is inserted in the bus and precedes said register.

Images